CVE-2026-127050: Backup Migration before 2.1.8 Path Traversal via PclZip Restore Fallback
Backup Migration before 2.1.8 for WordPress contains a path traversal vulnerability in its PclZip restore fallback that allows an attacker to achieve arbitrary file write when an administrator restores a malicious backup archive on a server lacking the PHP zip extension. Attackers can craft a zip archive with entry names containing ".." sequences, which PclZip's extract() processes without the PCLZIPOPTEXTRACTDIRRESTRICTION option, writing a PHP file outside the intended extraction directory into the web-servable tree to achieve remote code execution.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.1.8
Event History
Frequently Asked Questions
Which environments are exposed to exploitation?
Installations running Backup Migration before 2.1.8 are exposed when the server lacks the PHP zip extension, causing restores to use the vulnerable PclZip fallback. Exploitation also requires an administrator to restore an attacker-controlled backup archive.
What must an attacker do to achieve code execution?
The attacker must provide a crafted ZIP backup containing entry names with ".." path-traversal sequences. When an administrator restores it through the PclZip fallback, the archive can write a PHP file outside the intended extraction directory into a web-accessible location, enabling remote code execution.
Is a normal restore configuration affected?
The vulnerable behavior is specific to the restore fallback used when the PHP zip extension is unavailable. Systems using the PHP zip extension are not described as using the affected PclZip extraction path.